Privacy Policy.

Why Not Bot is a sole-trader consultancy operated by Richard Patey. This policy explains what data we hold, how we use it, and your rights under UK GDPR.

1. Who we are

The data controller is Richard Patey, trading as Why Not Bot. You can contact us at richard@whynot.bot.

2. What we collect

We only collect data you knowingly provide:

• Information you send us by email or through the contact form on whynot.bot (name, email, organisation, the contents of your message). Form submissions are processed and stored by our website host, Netlify.
• Information shared during discovery calls and project work, typically organisational context, documents, and access credentials you authorise.
• Basic server logs from our website host (IP address, browser, pages visited). No cookies or analytics are used on whynot.bot itself.

3. How we use it

We use your information solely to respond to enquiries, deliver work you've engaged us for, and meet legal obligations (tax, contract, professional records). We do not sell, rent, or share your data with third parties for marketing.

4. Where it's stored

Email correspondence is held in our business email provider. Project documents are stored in encrypted cloud storage. Where a project requires access to your systems (Google Drive, Microsoft 365, etc.), we use scoped credentials and remove access on project close unless otherwise agreed.

5. How long we keep it

We keep records for as long as needed to deliver the engagement and meet legal obligations, typically six years for financial records, after which we securely delete or anonymise.

6. Third-party AI providers

We build on AI platforms including Anthropic, OpenAI, and Google. Where a project sends data to these providers we operate under their enterprise/API terms, which prohibit training on customer data. We will tell you which providers are in scope before any data leaves your systems.

7. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict, or port your personal data, and to withdraw consent. Email richard@whynot.bot and we'll respond within 30 days.

8. Complaints

If you're unhappy with how we've handled your data you can complain to the UK Information Commissioner's Office at ico.org.uk.

9. Changes

We may update this policy. The "last updated" date at the top will change when we do; material changes will be flagged to active clients by email.